CVE-2026-63227: Koollab LMS SCORM Upload RCE Vulnerability

CVE-2026-63227 Overview

CVE-2026-63227 is an unrestricted file upload vulnerability in Koollab LMS. An authenticated user with the module designer role can upload a SCORM package containing a PHP webshell. The application stores the extracted archive contents in a publicly accessible directory, allowing the attacker to invoke the webshell over HTTP and execute arbitrary code on the server.

The issue is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type. It was published to NVD on 2026-07-29 and last updated on 2026-07-30.

Critical Impact

A single authenticated designer account can be leveraged to gain full remote code execution on the LMS host, compromising course content, user data, and any adjacent systems reachable from the server.

Affected Products

• Koollab LMS (SCORM package upload functionality)

Discovery Timeline

• 2026-07-29 - CVE-2026-63227 published to NVD
• 2026-07-30 - Last updated in NVD database
• CSA Advisory - Documented in CSA Security Advisory AL-2026-094

Technical Details for CVE-2026-63227

Vulnerability Analysis

Koollab LMS accepts SCORM (Sharable Content Object Reference Model) packages from users assigned the module designer role. SCORM packages are ZIP archives that bundle course content, including HTML, JavaScript, and supporting assets.

The application extracts the archive to a directory served by the web server without validating the file types contained inside. An attacker can place a .php file inside the SCORM ZIP, upload it as a course module, and then request the file directly through the web root. The PHP interpreter executes the file, producing a functional webshell.

Because the exploit runs in the context of the web server process, the attacker inherits its privileges. This exposes application configuration, database credentials, uploaded learner data, and any lateral network paths available from the host.

Root Cause

The root cause is missing server-side validation on SCORM archive contents [CWE-434]. The upload handler trusts the archive structure and file extensions supplied by the client. It does not enforce an allowlist of permitted MIME types or extensions, and it does not strip executable script types before writing the extracted files to a directory mapped to the web root.

Attack Vector

Exploitation requires authenticated access with the module designer role. The attacker packages a PHP webshell alongside legitimate SCORM manifest files, uploads the archive through the standard course authoring workflow, and then issues an HTTP request to the extracted webshell path. See the CSA Security Advisory AL-2026-094 for the reported technical details.

Detection Methods for CVE-2026-63227

Indicators of Compromise

• New or modified files with .php, .phtml, .phar, or other executable script extensions inside SCORM content directories.
• Outbound network connections initiated by the web server process to unfamiliar hosts shortly after a SCORM upload.
• Web access logs showing direct GET or POST requests to script files inside course content paths that were previously only accessed as static assets.

Detection Strategies

• Inventory SCORM extraction directories and alert on any file whose extension is handled by the PHP interpreter.
• Correlate module designer upload events with subsequent HTTP requests to files under the same course path.
• Monitor for process lineage in which the web server (php-fpm, apache2, nginx worker) spawns shells, curl, wget, or reconnaissance binaries.

Monitoring Recommendations

• Forward web server access logs, application audit logs, and host process telemetry to a central analytics platform for correlation.
• Baseline normal SCORM upload volume per user and flag deviations, particularly outside business hours.
• Track file integrity in course content directories and alert on the creation of executable script types.

How to Mitigate CVE-2026-63227

Immediate Actions Required

• Restrict the module designer role to a minimal set of trusted accounts and enforce multi-factor authentication on those accounts.
• Configure the web server to disable script execution within SCORM extraction directories until a patched build is deployed.
• Audit existing SCORM content directories for any files with executable extensions and remove or quarantine them.

Patch Information

Refer to the CSA Security Advisory AL-2026-094 for vendor patch guidance. Apply the fixed version supplied by Koollab as soon as it becomes available in your environment, and validate that the fix enforces server-side content validation on SCORM archives.

Workarounds

• Move SCORM extraction paths outside the web root and serve content through a controlled handler that returns files as static assets only.
• Add web server rules that deny execution of .php, .phtml, and .phar files inside course content directories.
• Validate uploaded archives on the server, rejecting any entry whose extension or MIME type falls outside an approved allowlist for course assets.

# Apache example: block PHP execution inside the SCORM content directory
<Directory "/var/www/koollab/scorm_content">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar|phps)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx example: return 403 for script files under the SCORM path
location ^~ /scorm_content/ {
    location ~* \.(php|phtml|phar|phps)$ {
        deny all;
        return 403;
    }
}